Dependency Upgrade Planner

The problem

Upgrading dependencies often leads to broken builds, un-reviewable massive pull requests, and hidden breaking changes. Developers frequently struggle to prioritize security patches over feature updates while managing complex peer dependency conflicts.

What it does

• Inventories all outdated packages by reading lockfiles and manifest files across various ecosystems.
• Triages updates into security, feature, and safe categories with risk scoring.
• Generates a staged upgrade order to minimize the blast radius, recommending leaf dependencies first.
• Maps specific breaking changes from release notes to required code modifications in your repo.
• Defines a concrete verification and rollback strategy for each upgrade step.

Frameworks & tools

Works with npm, pip, cargo, go, and poetry. Supports security scanning via npm audit, pip-audit, osv-scanner, and govulncheck.

Why this beats prompting it yourself

General LLMs often suggest bulk updates that break projects. This skill enforces a structured migration path that isolates major version bumps into individual, testable pull requests based on dependency depth and actual code usage.

Use cases

• Executing a safe migration from a legacy framework version to the latest major release.
• Responding to high-severity CVE alerts with a validated patch and rollback plan.
• Cleaning up technical debt by identifying unmaintained or pinned legacy packages.
• Performing pre-release audits to ensure all non-breaking patches are applied.

Known limitations

Requires read access to project lockfiles and the ability to execute environment-specific audit commands. It does not perform the actual code refactoring but maps the tasks required.